diff --git a/.ciagent/ARCHITECTURE.md b/.ciagent/ARCHITECTURE.md index d70c786..5f43d2e 100644 --- a/.ciagent/ARCHITECTURE.md +++ b/.ciagent/ARCHITECTURE.md @@ -510,4 +510,64 @@ sub-resource. S3 Object Lock + JWS detached signatures + async worker + DLQ + daily checkpoints (audit ledger build-out) — deferred to a future milestone. The hash-chain + DynamoDB-outbox path remains the v1.9 production audit -record. \ No newline at end of file +record. + +## v1.10 Addendum — Regression VERIFY + Local Emulators + Capability Re-Verification + +### Regression-Class VERIFY (D-091, `core/regression_verify.py`) + +The standard VERIFY stage was diff-scoped (it checked the phase diff +only, never re-ran underlying capability). This let 8 NFR-patch phases +(v1.9.1–v1.9.8) pass while the platform decayed. The regression-class +VERIFY (`core/regression_verify.py`) re-runs capability checks against +the current codebase and tags each Verified/Decayed/Broken. It fails +closed on any non-Verified capability, blocking milestone completion. + +The registry (`CAPABILITY_REGISTRY`) holds 16 capability checks +(CAP-001..CAP-016): 12 local-tier + 4 live-AWS. Adding a capability is +a single function + one registry entry. The gate runs via +`scripts/run_regression.sh` and writes `.ciagent/REGRESSION_REPORT.md` ++ `.json`. + +### Local Emulating Adapters (D-092, `core/local_emulators.py`) + +Four local adapters let the platform run the full headline E2E without +cloud credentials: + +- `FlatFileOutbox` — flat-file DynamoDB outbox emulator (hash-chained + JSONL; resumable across instances; chain verification). +- `LocalEcsEmulator` — local ECS Fargate HTTP 200 emulator (binds port + 0 on 127.0.0.1; daemon thread; clean destroy). +- `LocalS3StateBackend` — rewrites the terraform S3 backend to a local + backend (per-stack tfstate in a temp folder). +- `LocalLambdaStub` — invokes the contract_ingestor handler in-process + (patches `_get_dynamodb`/`_get_secrets_client`/`urllib.urlopen`; + DynamoDB writes redirected to the FlatFileOutbox). + +`run_local_e2e()` runs the full pipeline: contract → resolver → adapter +→ local S3 backend → local ECS (HTTP 200) → flat-file outbox (chain +verified) → local Lambda (200). Gated on `ACDL_LOCAL_TIER=1`. + +### Capability Re-Verification Sweep (D-093) + +`.ciagent/CAPABILITY_INVENTORY.md` enumerates 16 auto-verified +capabilities + 6 IAM-gated escalated resources. The sweep found and +fixed 7 adapter defects in `adapters/terraform/adapter.py` (duplicate +outputs, duplicate args, missing required args, deprecated AWS provider +v5 arg names). The headline E2E now passes at both tiers: local +emulator + live-AWS terraform init/validate/plan. + +### Adapter Defect Fixes (P54) + +7 defects fixed in `adapters/terraform/adapter.py`: +1. Duplicate output definitions (per-resource + stack-level both emitted). +2. Duplicate `desired_count`/`launch_type` on ECS service. +3. Duplicate `target_type`/`family`/`load_balancer_type`. +4. Missing `assume_role_policy`/`role_name` on IAM role (L2 composition gap). +5. Missing `cidr_block`/`vpc_id`/`name` defaults on VPC/subnet/route_table/ + ECS cluster/ECR repository. +6. ECR `kms_key_arn` unsupported arg → `encryption_configuration` block. +7. CloudFront OAC + WAF deprecated arg names (AWS provider v5): + `signing_behavior`, `signing_protocol`, `origin_access_control_id`, + `s3_origin_config.origin_access_identity`, `origin_id`, `rule` + (singular), `scope=CLOUDFRONT` (uppercase). \ No newline at end of file diff --git a/.ciagent/AUDIT.md b/.ciagent/AUDIT.md index ccb81b0..5b652f9 100644 --- a/.ciagent/AUDIT.md +++ b/.ciagent/AUDIT.md @@ -171,4 +171,76 @@ advertised v1.1–v1.8 capability is re-verified (D-093, 16/16 Verified); the docs/decks match verified reality (D-094). 0 P0, 0 P1 from review; 1 P2 (post-hoc: expand regression registry to uptime-kuma + RDS stacks). 513 offline tests pass; the regression gate covers 16 capabilities -including 4 live-AWS checks. Ready to tag `v1.10.0`. \ No newline at end of file +including 4 live-AWS checks. Ready to tag `v1.10.0`. + +--- + +# ACDL v1.10 — Post-Ship Audit (ciagent-audit workflow) + +> Audit date: 2026-07-27. Auditor: ci-debugger. Milestone: v1.10 +> (shipped, tag `v1.10.0`). Result: PASS (1 issue fixed during audit). + +## Step 1: Reconstruction Test — PASS + +Parsed all `---ci---` blocks from `v1.9.8..HEAD` (9 commits). +Reconstructed state: +- Phases: 52, 53, 54, 55 (+ boundary commits 0, 51) +- Milestone: v1.10 +- Final status: complete +- Decisions: D-090..D-094 +- Requirements: REQ-112..REQ-115 +- Regression caps: CAP-001..CAP-016 + +Compared with `.ciagent/` files: +- config.json: milestone v1.10, status complete. **MATCH.** +- ROADMAP.md: phases 52–55 present, all complete. **MATCH.** +- REQUIREMENTS.md: REQ-112..115 all complete. **MATCH.** +- PROJECT.md: D-090..D-094 decision rows present. **MATCH.** +- CAPABILITY_INVENTORY.md: CAP-001..CAP-016 all Verified. **MATCH.** + +**Reconstruction: PASS** — state fully reconstructable from git log. + +## Step 2: .ciagent/ File Discipline — PASS (1 issue fixed) + +- `config.json`: valid JSON, required fields present. **PASS.** +- `PROJECT.md`: all required sections present (Vision, North Star, + Capability Status, Requirements, Key Decisions, Constraints, + Anti-Goals). **PASS.** +- `ROADMAP.md`: phases 52–55 present, v1.10 marked complete. **PASS.** +- `REQUIREMENTS.md`: REQ-112..115 all complete in traceability table. + **PASS.** +- `ARCHITECTURE.md`: **FIXED DURING AUDIT** — had 0 references to + v1.10 components (regression_verify, local_emulators, + REGRESSION_REPORT, CAPABILITY_INVENTORY). Added a v1.10 addendum + section covering the regression-class VERIFY, local emulating + adapters, capability re-verification sweep, and the 7 adapter defect + fixes. Now references all v1.10 components. **PASS (after fix).** + +## Step 3: Branch Hygiene — PASS + +- Local: `main` only. Remote: `origin/main` only. +- No phase or milestone branches (flat workflow per project convention). +- No orphan branches. +**PASS.** + +## Step 4: Commit Discipline — PASS + +- 9/9 v1.10 commits have `---ci---` blocks with project/phase/milestone/ + status fields. +- Decisions D-090..D-094: D-091/D-092/D-093 have code refs + (`core/regression_verify.py`); D-090/D-094 are process/meta decisions + with extensive `.ciagent/` doc refs (PLAN, ROADMAP, PROJECT, + CAPABILITY_INVENTORY, AUDIT, VERIFY). No stale decisions. +- No unresolved v1.10 escalations (the 6 IAM-gated resources are + documented in CAPABILITY_INVENTORY.md, not unresolved escalations). +**PASS.** + +## Issues fixed during audit + +1. **ARCHITECTURE.md missing v1.10 addendum** — the architecture doc + had no coverage of the v1.10 new components (regression_verify, + local_emulators, capability inventory, adapter defect fixes). Fixed: + added a v1.10 addendum section covering all 4 new subsystems + the + 7 adapter defect fixes. Verified all v1.10 components now referenced. + +## Audit result: PASS \ No newline at end of file